Technical Tip: How to downgrade in case of SSL VPN removal after automatic upgrade to v7.6.3

Description

This article describes how to quickly revert to the previous firmware in configuration in case of SSL VPN tunnel mode removal after automatic upgrade to v7.6.3.

Scope

FortiGate.

Solution

Starting from v7.4.5 and v7.6.1, automatic firmware upgrades are enabled by default. In v7.6.3, SSL VPN tunnel mode is removed.

If automatic firmware upgrades were not disabled, this may result in FortiGate upgrading to v7.6.3 before completing the migration to IPsec, causing remote VPN access to be lost.

Downgrading the FortiGate by applying the previous firmware file will not resolve the issue and will result in lost configuration. Instead, the fastest way to recover is to boot from the alternate partition where the previous firmware and configuration are preserved. Only physical devices support this recovery method- FortiGate-VM should be recovered manually by applying a virtual machine backup or snapshot on the hosting platform. If FortiGate-VM does not have a virtual machine backup or snapshot, downgrade back to the previous firmware and restore the backup configuration that was previously taken.

This method also applies if remote SSL VPN access was lost after a planned upgrade to v7.6.3 or later, for example, after an upgrade from v7.4.6 to v7.6.3.

A detailed guide can be found in this KB article: Technical Tip: Selecting an alternate firmware for the next reboot.

After booting to the previous version, it is recommended to disable the automatic firmware upgrade until the migration to IPsec VPN is completed.

More information can be found in this KB article: Technical Tip: How to disable automatic firmware upgrades on FortiGate.

A detailed guide for SSL VPN to IPsec VPN migration can be found in this document: SSL VPN to IPsec VPN Migration.